CVE-2026-2675 Overview
CVE-2026-2675 is a Missing Authentication for Critical Function vulnerability [CWE-306] in RTI Connext Professional Security Plugins. The flaw allows an attacker to fake the source of data in Data Distribution Service (DDS) communications. By spoofing data origin, an adversary can inject messages that downstream subscribers accept as legitimate. The vulnerability affects Connext Professional versions 7.4.0 before 7.7.0, 7.0.0 before 7.3.1.3, and the 6.1.x, 6.0.x, and 5.3.x branches.
Critical Impact
An unauthenticated network-adjacent attacker can impersonate trusted publishers in DDS deployments, undermining data integrity across distributed control, robotics, and mission-critical systems.
Affected Products
- RTI Connext Professional 7.4.0 before 7.7.0
- RTI Connext Professional 7.0.0 before 7.3.1.3
- RTI Connext Professional 6.1.x, 6.0.x, and 5.3.x (all releases in these branches)
Discovery Timeline
- 2026-06-17 - CVE-2026-2675 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2026-2675
Vulnerability Analysis
RTI Connext Professional implements the Object Management Group (OMG) Data Distribution Service (DDS) standard for real-time publish-subscribe messaging. The Security Plugins module provides authentication, access control, and cryptographic protection for DDS participants. CVE-2026-2675 stems from a missing authentication check on a critical function that validates the source of inbound data samples.
Because the source identity is not properly authenticated, an attacker on the network can publish messages that appear to originate from a trusted DataWriter. Subscribers process the spoofed samples as authentic, corrupting application state without any indication of tampering. The vulnerability impacts integrity only; confidentiality and availability are not directly affected.
The attack requires low-privilege access to the DDS domain, which limits exposure in segmented networks but remains significant in production deployments where DDS traffic traverses shared infrastructure.
Root Cause
The Security Plugins fail to enforce origin authentication on a critical code path that processes incoming data. A required cryptographic verification step is either skipped or improperly applied, allowing forged sender identifiers to pass validation. This is a textbook [CWE-306] Missing Authentication for Critical Function condition.
Attack Vector
The attack is conducted over the network against the DDS data plane. An attacker with the ability to send DDS RTPS packets to participants in a secured domain can craft messages that impersonate an authorized publisher. No user interaction is required. Refer to the RTI Vulnerability Overview for vendor technical details.
Detection Methods for CVE-2026-2675
Indicators of Compromise
- Unexpected duplicate DataWriter GUIDs observed within a single DDS domain.
- DDS subscribers receiving samples with sequence numbers or timestamps inconsistent with the legitimate publisher's pattern.
- RTPS traffic originating from network endpoints not enrolled as authorized participants.
Detection Strategies
- Enable verbose logging in RTI Connext Security Plugins and alert on authentication anomalies or unexpected participant discovery events.
- Baseline normal publisher-subscriber relationships and flag deviations such as new GUIDs publishing to security-critical topics.
- Inspect RTPS packets at network choke points to validate that source IP addresses align with the expected publisher inventory.
Monitoring Recommendations
- Forward DDS participant and security plugin logs to a centralized SIEM for correlation with network telemetry.
- Monitor application-layer integrity checks where DDS data feeds safety or control decisions, and alert on out-of-bounds values.
- Track patch compliance across all Connext Professional installations to ensure no vulnerable branch remains in production.
How to Mitigate CVE-2026-2675
Immediate Actions Required
- Inventory all RTI Connext Professional deployments and identify versions matching the affected ranges.
- Upgrade to Connext Professional 7.7.0 or 7.3.1.3, depending on the deployed branch.
- Restrict DDS domain access to authenticated hosts using network segmentation and firewall rules.
- Rotate Security Plugins credentials and certificates after patching to invalidate any keys exposed during the vulnerable window.
Patch Information
RTI has released fixed versions addressing CVE-2026-2675. Upgrade paths are 7.4.0–7.6.x to 7.7.0, and 7.0.0–7.3.1.2 to 7.3.1.3. The 6.1.x, 6.0.x, and 5.3.x branches require migration to a supported fixed release. See the RTI Vulnerability Overview for full version guidance.
Workarounds
- Isolate DDS domains on dedicated VLANs or physically separated networks to reduce the attacker's ability to inject RTPS traffic.
- Apply strict access control list configurations in the Security Plugins governance and permissions files to limit which participants can publish on sensitive topics.
- Deploy network intrusion detection signatures for anomalous RTPS submessages and enforce mutual TLS or IPsec on transports carrying DDS traffic.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
